TO: 


Of: 


ICO. 


Information Commissioner’s Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Unite the Union 


128 Theobalds House, Holborn, London, WC1X 8TN. 


The Information Commissioner (“Commissioner”) has decided to 
issue Unite the Union (“Unite”) with a monetary penalty under section 
55A of the Data Protection Act 1998 (“DPA”). The penalty is being 
issued because of a serious contravention of regulation 21 of the 
Privacy and Electronic Communications (EC Directive) Regulations 
2003, as amended (“PECR”). 


This notice explains the Commissioner's decision. 


Legal framework 


Unite the Union, is an independent trade union registered with the 
Certification Officer in accordance with the provisions of the Trade 
Union and Labour Relations (Consolidation) Act 1992. It is the 
organisation stated in this notice to have used a public electronic 
communications service for the purpose of making unsolicited calls for 


the purpose of direct marketing contrary to regulation 21 of PECR. 


@ 
1CcCO. 
Information Commissioner's Office 
Regulation 21 applies to the making of unsolicited calls for direct 
marketing purposes. It means that if a company wants to make calls 
promoting a product or service to an individual who has a telephone 
number which is registered with the Telephone Preference Service Ltd 


(“TPS”), then that individual must have given their consent to that 


company to receive such calls. 


Regulation 21 paragraph (1) of PECR provides that: 


“(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 


Regulation 21 paragraphs (2)-(5) provide: 


“(2) A subscriber shall not permit his line to be used in contravention of 


paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 


(4) Where a subscriber who has caused a number allocated to a line of 


his to be listed in the register kept under regulation 26 has notified 
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a caller that he does not, for the time being, object to such calls 
being made on that line by that caller, such calls may be made by 


that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at 
any time, and 
(b) where such notification is withdrawn, the caller shall not 


make such calls on that line.” 


Under regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 
that they do not wish, for the time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The Telephone Preference 
Service Ltd (“TPS”) is a limited company which operates the register 
on the Commissioner’s behalf. Businesses who wish to carry out direct 
marketing by telephone can subscribe to the TPS for a fee and receive 


from them monthly a list of numbers on that register. 


Section 122(5) of the Data Protection Act 2018 (“DPA 2018”) defines 
direct marketing as “the communication (by whatever means) of any 
advertising or marketing material which is directed to particular 
individuals”. This definition also applies for the purposes of PECR (see 
regulation 2(2) PECR and paragraphs 430 & 432(6) to Schedule 19 of 
the DPA 2018). 


Consent in PECR is defined by reference to the concept of consent in 
the General Data Protection Regulation 2016/679 (“the GDPR”): 
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regulation 8(2) of the Data Protection, Privacy and Electronic 
Communications (Amendments etc) (EU Exit) Regulations 2019. 
Article 4(11) of the GDPR sets out the following definition of consent of 
the data subject as meaning “any freely given, specific, informed and 
unambiguous indication of the data subject's wishes by which he or 


she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her”. 


Recital 32 of the GDPR materially states that “When the processing has 
multiple purposes, consent should be given for all of them”. Recital 42 
materially provides that “For consent to be informed, the data subject 
should be aware at least of the identity of the controller”. Recital 43 
materially states that “Consent is presumed not to be freely given if it 
does not allow separate consent to be given to different personal data 
processing operations despite it being appropriate in the individual 


case”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


Section 55A of the DPA (as applied to PECR cases by Schedule 1 to 


PECR, as variously amended) states: 


"(1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
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(b) subsection (2) or (3) applies. 


(2) This subsection applies if the contravention was deliberate. 


(3) This subsection applies if the person - 
(a) knew or ought to have known that there was a risk that 
the contravention would occur, but 
(b) failed to take reasonable steps to prevent the 


contravention. 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 
The provisions of the DPA remain in force for the purposes of PECR 


notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 


Background to the case 


Unite is an independent trade union. It came to the attention of the 


Commissioner in February 2020 when complaints about unsolicited 
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direct marketing calls received in January 2020 were consolidated into 
a “Direct Marketing Monthly Threat Assessment” report compiled by the 
Information Commissioner's Office (“ICO”). Two complaints from 
subscribers registered with the TPS were made about Unite in relation 
to life insurance marketing calls. Further investigations revealed an 


additional 25 complaints which had been made directly to the 


Commissioner via her online reporting tool. 


On 12 March 2020, the Commissioner sent an initial investigation letter 
to Unite, setting out her concerns about the organisation's compliance 
with PECR, attaching details of some of the complaints received by her, 
and requesting information about its business and marketing activities 


which would assist in her investigation. 


Unite responded on 27 April 2020, advising the Commissioner it did not 
“run or promote a business”, nor did it have customers. It obtained all 
of its personal data directly from members either when they made an 
online application to join Unite, by completing a hard copy membership 
application form (the contents of which were then uploaded to their 
membership system), or by changing or adding to their personal 
contact data after joining via their online account, calling the helpline 


or contacting one of Unite’s various offices. 


In response to the Commissioner’s request for evidence of consent to 
receiving marketing calls, Unite advised the Commissioner it did not 
make unsolicited marketing calls; only calls updating members on the 
“services and benefits available to them under their union membership 


A 


via Unite’s membership helpline.” Unite said this was a requirement in 
line with its Rule Book which governed membership of the trade union. 


The calls were undertaken by a third party processor, in accordance 
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with members’ communication preferences. It added that the third 


party operated TPS screening. 


Unite said its membership communication system acted as an internal 
suppression list. Members set their communication preferences when 
joining the Union and could change them at any time either by logging 
into their membership record via Unite’s website, or by telephoning 
Unite. 


The Commissioner obtained a screenshot of the communication 
preferences presented to Unite members at the point of joining the 


union online: 


“We may use the details provided by you to contact you at your 
home address, by telephone, SMS or email in order to provide 
information specific to being a member of Unite the Union, 
including union activities, campaigns, services and/or benefits. If 
you wish in the future to opt-out of receiving information about 
any individual member benefit or service or change how we 
communicate with you, then you should visit the MyUnite website 
https://myunite. unitetheunion.org/login or contact your regional 
office. For full details as to how Unite will process your data 
please see Unite the Union’s up to date privacy notice HERE 
(https://unitetheunion.org/legal-information/privacy-policy) or 
contact your regional office for a copy.” 


The Commissioner noted that whilst individuals were told how to opt- 
out of receiving information, they were not given the option to opt-in to 
specific means of communication in relation to specific types of 
“services and/or benefits”. There was no option for individuals to 


agree to electronic direct marketing from third parties, to select which 
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third parties, if any, they might wish to be contacted by, or to select 


the method by which they might consent to being contacted. 


In response to the Commissioner's request for an explanation for nine 
of the complaints received by her, Unite did not agree with all the 
information provided by the case officer, stating that four of the calls 
did not connect to the subscriber and one call involved a matter 
unrelated to life insurance. Unite accepted the remaining four calls 
were to numbers registered with the TPS and should have been picked 
up by its third party processor through its TPS screening. In later 
correspondence, Unite explained this was a result of human error, and 
that the third party had changed their practices to ensure it did not 
happen again. Unite did not address the point that TPS screening would 
only have been necessary if it accepted the calls constituted direct 


marketing. 


Unite provided details of its employee online interactive data protection 
training and said that staff were trained to “utilise PECR compliant 
principles when sending emails to members regarding any union 
activities.” A copy of Unite’s email guidance was attached, and 
included a link to the Commissioner’s “Guide to PECR”. An equivalent 


guide was not produced in relation to making telephone calls. 


The Commissioner wrote to Unite again on 5 May 2020, requesting the 
sections of Unite’s Rule Book governing calls about life insurance, and 


the telephone script used for making such calls. 


On 27 May 2020, Unite responded, highlighting the following rules from 
its Rule Book: 


“2.1 The objects of the Union shall be: 
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2.1.10 To provide such financial and other benefits and legal assistance 


to members as may be specified in these rules. 


2.1.12 To communicate information to members about union activities, 
campaigns, services and/or benefits, so as to encourage participation 


and further these objects. 


4.9 The Executive Council may provide, agree and permit other 
organisations to provide to members and their households insurance, 
financial, legal, consumer and other services and products and loyalty 
or other similar schemes and Unite may provide by direct mailing or 
otherwise to members concerning such services, products and 


schemes.” 


Unite also provided a copy of their “Unite Life Financial Protection - 
Awareness Script” for calls to members regarding life insurance. Whilst 
Unite maintained they were contractually obliged to provide the 
information, members were given the option to find out more about the 
life insurance on three separate occasions. The script was written in a 
marketing style, offering “NEW benefits” and a “free life insurance and 
protection review” with the opportunity to “save money”. The script 
was in the form of a flow chart, with the ultimate objective of 
transferring members to a United Life advisor through whom they could 


purchase life insurance. 


Whilst Unite maintained these were not marketing calls, complainants 
believed them to be so, stating the callers were “trying to sell me 


health care / insurance"; “marketing for life insurance”; “trying to sell 


me insurance”. 
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The complaints made to the Commissioner indicate that not only did 


Unite make initial calls in breach of PECR, but also continued to call 


individuals who had specifically asked not to be contacted: 


e “I have repeatedly asked the company to remove me from their 
marketing lists, have had confirmations that they have done so and 


yet I am still receiving calls. It’s incredibly annoying.” 
e “Caller had already been instructed not to call but called again.” 


The Commissioner sought details of the volume of life insurance calls 
during the period 11 March 2019 to 11 March 2020. Unite responded, 
explaining seven telephone numbers were used to make 1,385,522 
calls, of which 726,853 connected. Subsequent screening against the 
TPS register showed of these connected calls, 57,665 were to 


individuals registered with the TPS for not less than 28 days. 


Following a request from the Commissioner, Unite provided a copy of 
its contract with its third party processor showing Unite to be the 
instigator of the marketing calls. The contract required the third party 
processor to provide the following data processing services on behalf of 
Unite: 


“2.2.6 Telephoning members regarding subscription arrears and 
alternative Union membership schemes / rates and services available 


to members 


3.3 The Service Provider will process the Union Data only in accordance 
with documented instructions from the Union (which may be specific 
instructions or instructions of a general nature) as required by the 


services that the Service Provider provides to the Union.” 
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The Commissioner is satisfied Unite was the instigator of the marketing 


calls relating to life insurance. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute a 
contravention of regulation 21 of PECR by Unite and, if so, whether the 


conditions of section 55A DPA are satisfied. 


The contravention 


The Commissioner finds that Unite contravened regulation 21 of PECR. 


The Commissioner finds that the contravention was as follows: 


Between 11 March 2019 and 11 March 2020, Unite used a public 
telecommunications service for the purposes of making 57,665 
unsolicited calls for direct marketing purposes to subscribers where the 
number allocated to the subscriber in respect of the called line was a 
number listed on the register of numbers kept by the Commissioner in 
accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. 


The Commissioner is also satisfied for the purposes of regulation 21 
that these 57,665 unsolicited direct marketing calls were made to 
subscribers who had registered with the TPS at least 28 days prior to 
receiving the calls, and they had not given their prior consent to Unite 
to receive calls. These calls resulted in a total of 27 complaints over 


the period of contravention. 
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The Commissioner is satisfied that these calls constituted direct 
marketing as defined by section 122(5) of the DPA 2018 because each 
of the calls encouraged members to have a “free life insurance and 
protection review” from a third party whose business was to sell life 


insurance. 


Unite stated on a number of occasions that it did not make unsolicited 
marketing calls. It considered any calls were made in accordance with 
its Rule Book which required Unite to “notify members of the services 
and benefits that fall within their union membership and any changes 
to those terms.” The Commissioner has rejected this suggestion 
because the Unite rules cannot override the statutory protection 
afforded by PECR Regulation 21. 


For consent to be valid it is required to be “freely given”, by which it 
follows that if consent to marketing is a condition of subscribing to a 
service, the organisation will have to demonstrate how the consent can 


be said to have been given freely. 


Consent is also required to be “specific” as to the type of marketing 
communication to be received, and the organisation, or specific type of 


organisation, that will be sending it. 


Consent will not be “informed” if individuals do not understand what 
they are consenting to. Organisations should therefore always ensure 
that the language used is clear, easy to understand, and not hidden 
away in a privacy policy or small print. Consent will not be valid if 
individuals are asked to agree to receive marketing from “similar 


non "Oy 


organisations”, “partners”, “selected third parties” or other similar 


generic description. 


The Commissioner is satisfied the consent relied upon by Unite is 


insufficient for the purposes of Regulation 21. Individuals were broadly 
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informed that their personal information may be used to contact them 
in relation to services and/or benefits. This is insufficient to inform an 
individual about what they can expect the marketing to consist of and 
consent must be informed to be valid. From the information provided 
at the point of sign up, Unite automatically opt individuals in to contact 
about the “services and/or benefits”. This is not a positive opt in to 
receive marketing by any particular method and resultantly valid 
consent is not obtained for the purpose of making marketing calls to 


individuals registered with the TPS for not less than 28 days. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 


Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because there were multiple breaches of 
regulation 21 by Unite arising from the organisation's activities over a 
twelve-month period, resulting in 57,665 unsolicited direct marketing 
calls to subscribers who were registered with the TPS. These 57,665 
unsolicited calls led to a total of 27 complaints being made to the 


Commissioner over the period of contravention. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberat rnegligent contravention 


The Commissioner has considered whether the contravention identified 
above was deliberate. In the Commissioner’s view, this means that 


Unite’s actions which constitute that contravention were deliberate 
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actions (even if Unite did not actually intend thereby to contravene 
PECR). 


The Commissioner does not consider that Unite deliberately set out to 


contravene PECR in this instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


Firstly, she has considered whether Unite knew or ought reasonably to 
have known that there was a risk that this contravention would occur. 


She is satisfied that this condition is met. 


The Commissioner has published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 
This guidance explains the meaning of direct marketing and the 
circumstances under which organisations are able to carry out 
marketing over the phone, by text, by email, by post or by fax. It 
states that live calls must not be made to subscribers who have told an 
organisation that they do not want to receive calls; or to any number 
registered with the TPS, unless the subscriber has specifically 
consented to receive calls. The Commissioner has also published 
detailed guidance on consent under the GDPR. In case organisations 
remain unclear on their obligations, the ICO operates a telephone 
helpline. ICO communications about previous enforcement action 
where businesses have not complied with PECR are also readily 


available. 


It is therefore reasonable to suppose that Unite should have been 


familiar with its responsibilities in this area. Unite demonstrated an 
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awareness of PECR, telling the Commissioner it trained employees to 


use “PECR compliant principles when sending emails”. 


Standard practice of the TPS is to contact the organisation making the 
calls on each occasion a complaint is made. It is therefore reasonable 
to believe that Unite would have received a notification from the TPS 
for each of the complaints being made in this case. That there were 
two complaints made to the TPS over the period of the contravention 
should have made Unite aware of the risk that such contraventions 


may occur and were indeed occurring. 


Secondly, the Commissioner has gone on to consider whether Unite 
failed to take reasonable steps to prevent the contravention. Again, she 


is satisfied that this condition is met. 


Unite failed to familiarise itself sufficiently with the requirements of 
PECR so as to identify direct marketing calls. It had miscategorised its 
calls by not recognising that the calls about life insurance constituted 
marketing, despite having TPS screening in place, which would only be 
necessary for marketing calls. Whilst Unite was able to produce 
emailing guidance for its employees which contained a link to the 
Commissioner's Guide to PECR, there was no corresponding guidance 


for making telephone calls to members. 


The Commissioner's direct marketing guidance makes clear that 
organisations must undertake rigorous checks to satisfy themselves 
they have the necessary consent before instigating direct marketing. If 
Unite had properly undertaken the customer journey then it seems 
reasonable to think that it would have realised that, at the point of 
consent, it was not possible for individuals to provide specific, informed 


and freely given consent to receive direct marketing calls from Unite. 
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Complainants also complained of reoccurring calls and therefore it was 


also incumbent on Unite to ensure that an effective suppression system 


was in place for individuals who did not wish to be contacted. 


Given the volume of calls and complaints, it is clear that Unite failed to 


take sufficient reasonable steps to prevent the contravention. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner has taken into account the following aggravating 


features of this case: 


e Advice or guidance on direct marketing and in particular, the making 
of marketing calls was ignored or not acted upon. Such guidance is 
freely available on the ICO website. The ICO Helpline is also available 


for organisations who may require clarity in their practices. 


The Commissioner has also taken into account the following mitigating 


features of this case: 


e The Commissioner noted the remedial action taken by Unite as 
soon as the contravention was highlighted. Changes were made 
to Unite’s data processor's screening process to ensure future 


compliance with PECR. 


For the reasons explained above, the Commissioner is satisfied that the 


conditions from section 55A (1) DPA have been met in this case. She is 
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also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking, and invited Unite to 


make representations in response. 


In reaching her final view, the Commissioner has received and 
considered representations in response to the Notice of Intent dated 26 
August 2021. This included the submission of a copy of its processor’s 


internal employee training/guidance regarding PECR. 


The Commissioner remains satisfied that a monetary penalty notice is 


an appropriate course of action. 


The Commissioner has considered the likely impact of a monetary 
penalty on Unite. She has decided on the information that is available 
to her, that Unite has access to sufficient financial resources to pay the 
proposed monetary penalty without causing undue financial hardship. 
She does not consider that this conclusion is altered by the effects of 


the current Covid-19 pandemic. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. The issuing of a 


monetary penalty will reinforce the need for businesses to ensure that 
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they are only telephoning consumers who specifically have not 


objected to receiving calls. 


The Commissioner has considered whether, in the circumstances, she 
should exercise her discretion so as to issue a monetary penalty. She 
has decided that a monetary penalty is an appropriate and 
proportionate response to the finding of a serious contravention of 
regulation 21 of PECR by Unite. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


Th mount of th n 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £45,000 (forty five thousand pounds) 
is reasonable and proportionate given the particular facts of the case 


and the underlying objective in imposing the penalty. 


Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 25 November 2021 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
24 November 2021 the Commissioner will reduce the monetary 
penalty by 20% to £36,000 (thirty six thousand pounds). 
However, you should be aware that the early payment discount is not 


available if you decide to exercise your right of appeal. 
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There is a right of appeal to the First-tier Tribunal (Information Rights) 
against: 


(a) the imposition of the monetary penalty 
and/or; 

(b) the amount of the penalty specified in the monetary penalty 
notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 
penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 25t day of October 2021. 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 SAF 


20 


ICO. 


Information Commissioner’s Office 


1CO. 


Information Commissioner’s Office 


ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that she ought to have exercised 


her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


ce You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE? 8DJ 
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Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you, 

G) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal must include a request for an extension of time 
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and the reason why the notice of appeal was not provided in 


time. 


5: Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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